JP7246032B2 - In-vehicle secure storage system - Google Patents

Description

The present disclosure relates to an in-vehicle secure storage system that transfers data between a host device and a storage device.

BACKGROUND ART In the field of in-vehicle systems, a large number of ECUs (Electronic Control Units) mounted on one vehicle are currently being integrated. When many ECUs are integrated, it becomes necessary to integrate the storage connected to each ECU.

Storage in the field of in-vehicle systems mainly uses SSDs and SD cards that use non-volatile memory. Techniques relating to SD cards and SD card-compatible hosts are disclosed in, for example, Japanese Unexamined Patent Application Publication No. 2002-200010. Also, in ECUs, PCI Express (registered trademark: hereinafter referred to as PCIe) is currently used as a high-speed serial interface.

JP 2006-209744 A

An object of the present disclosure is to provide an in-vehicle secure storage system that can easily and quickly detect unauthorized access to a storage device and malfunction of the storage device, and appropriately utilize the detection results.

The in-vehicle secure storage system of the present disclosure is an in-vehicle secure storage system that includes a storage device having a controller, a nonvolatile memory, and an interface, and an electronic control unit that electronically controls the vehicle. After judging that unauthorized access or malfunction has occurred in the nonvolatile memory, the controller performs predetermined processing according to the type of the unauthorized access or malfunction.

By using the in-vehicle secure storage system of the present disclosure, unauthorized access to the storage device and malfunction of the storage device can be detected easily and quickly, and the detection results can be used appropriately.

FIG. 1 is a block diagram of an in-vehicle secure storage system according to Embodiment 1. FIG . FIG. 2 is a flowchart of pre-processing in the in-vehicle secure storage system according to the first embodiment. FIG. 3 is a flowchart of basic processing including unauthorized access check processing in the in-vehicle secure storage system according to the first embodiment. FIG. 4 is a flow chart of defect check processing in the in-vehicle secure storage system according to the first embodiment. FIG. 5 is a list of types, definitions, and contents of unauthorized accesses/defects.

Hereinafter, embodiments will be described in detail with reference to the drawings as appropriate. However, more detailed description than necessary may be omitted. For example, detailed descriptions of well-known matters and redundant descriptions of substantially the same configurations may be omitted. This is to avoid unnecessary verbosity in the following description and to facilitate understanding by those skilled in the art.

It is noted that the inventor(s) provide the accompanying drawings and the following description in order for those skilled in the art to fully understand the present disclosure, which are intended to limit the claimed subject matter. not something to do.

[Background to this disclosure]
Conventionally, in an in-vehicle storage system, checking and detection of unauthorized processing (fraudulent acts) such as unauthorized access to the storage device, unauthorized writing, and unauthorized tampering are performed by a driver or controller on the side of the ECU, which is the host device. ing. Similarly, checking and detection of defects in the storage device are also performed by a driver or controller on the side of the ECU, which is the host device. Also, with regard to data tampering, there have been cases where the inside of the storage device is entirely checked to confirm the possibility of occurrence of unauthorized tampering, and then an actual tampering check is performed.

When unauthorized access occurs to a storage device, it is not easy for the host device to accurately identify the area or address where the unauthorized access occurred, and it takes a certain amount of time to identify it. . In particular, with respect to the above-described data tampering, it takes time and cost to check all the inside of the storage device and to actually check for tampering after confirming the possibility of tampering. In this case, the host device can actually perform detection only after a certain amount of time has passed since the unauthorized access or unauthorized tampering with the storage device.

The inventor has developed an in-vehicle secure storage system according to the present disclosure that solves the above problems. The in-vehicle secure storage system according to the present disclosure generally performs fraudulent processing (fraudulent acts) on the storage device and checks and detects defects in the storage device by itself (that is, by the storage device).

Therefore, in the in-vehicle secure storage system according to the present disclosure, the area or address on the storage device where unauthorized access or the like has occurred can be easily and quickly specified, and immediately after or during the occurrence of unauthorized access or the like, The host device can grasp the failure. Thus, the host device can react faster and the impact of fraud or failure is minimized. Furthermore, it may be possible for the host device to have no external effects due to fraudulent actions or malfunctions.

[Embodiment 1]
An in-vehicle secure storage system according to Embodiment 1 of the present invention will be described below with reference to the drawings.

[1.1. Configuration of in-vehicle secure storage system]
FIG. 1 is a block diagram of an in-vehicle secure storage system 2 according to Embodiment 1. As shown in FIG. The in-vehicle secure storage system 2 shown in FIG. 1 is an in-vehicle system.

The in-vehicle secure storage system 2 according to the present embodiment shown in FIG. 1 includes an in-vehicle ECU 20 and a storage device 4 . The storage device 4 includes a controller 6 and a non-volatile memory 12 such as a NAND flash memory. The controller 6 includes a main bus interface 8 and a sideband interface 10 . The in-vehicle ECU 20 similarly includes a main bus interface 22 and a sideband interface 24 .

The in-vehicle secure storage system 2 uses PCIe as a high-speed serial interface, and the main bus interface 22 of the in-vehicle ECU 20 and the main bus interface 8 of the storage device 4 are connected to the PCIe bus 14 . Since the PCIe bus 14 is also connected to an external communication module 18 conforming to WiFi (registered trademark) or the like, the in-vehicle secure storage system 2 communicates data with, for example, an external cloud storage via the external communication module 18. can do
The sideband interface 24 of the in-vehicle ECU 20 and the sideband interface 10 of the storage device 4 are connected via a sideband bus (SD bus) 16 for data communication.

The nonvolatile memory 12 in the storage device 4 is divided into multiple logical areas. In addition, non-volatile memory 12 is controlled by controller 6 with respect to data input, output, and storage.

A controller 6 in the storage device 4 controls input, output, and storage of data to the nonvolatile memory 12 . Therefore, as will be described later, the controller 6 also checks for unauthorized access to the nonvolatile memory 12 and checks for defects in the nonvolatile memory 12 . The storage device 4 is an information recording medium such as an SD card, for example.

The in-vehicle secure storage system 2 includes a room lamp 26, a monitor 28, a microphone 30, and a speaker 32 as peripheral devices, and the in-vehicle ECU 20 connects with these peripheral devices. The room lamp 26 is a lighting device in the vehicle, and indicates a signal or message that the in-vehicle ECU 20 should convey to the driver in the form of blinking or changing color of the lighting. The monitor 28 displays signals and messages that the in-vehicle ECU 20 should convey to the driver in the form of images. In addition, the driver inputs information to the in-vehicle ECU 20 by simply operating the screen of the monitor 28 . The speaker 32 expresses signals and messages that the in-vehicle ECU 20 should convey to the driver in the form of sound. Also, the driver receives the sound from the speaker 32 and inputs information to the in-vehicle ECU 20 by simple speech into the microphone 30 .

[1.2. Operation of in-vehicle secure storage system]
[1.2.1. Pre-processing in in-vehicle secure storage system]
FIG. 2 is a flowchart of pre-processing in the in-vehicle secure storage system 2 according to this embodiment. Pre-processing is typically started before the in-vehicle secure storage system 2 is shipped (step S02). In the pre-processing, first, initialization processing of the storage device 4 is performed (step S04). In the initialization processing of the storage device 4, the controller 6 creates a logical-to-physical conversion table that indicates the relationship between the physical address of the nonvolatile memory 12 and the logical address when the in-vehicle ECU, which is the host, accesses the table. including processing for storing in a RAM (not shown).

Next, the in-vehicle ECU 20 determines whether or not to add a logic area to the nonvolatile memory 12 (step S08). If a logical area is to be added (step S08, Yes), the in-vehicle ECU 20, which is the host, designates the required size and instructs the controller 6 of the storage device 4 to secure the area (step S10). The controller 6 of the storage device 4 secures the specified size, and notifies the host-mounted ECU 20 of the area ID of the logical area (step S12).

Steps S10 and S12 are repeated as long as it is necessary to add a logical area on the nonvolatile memory 12 (step S08, Yes). If it is no longer necessary to add a logical area to the nonvolatile memory 12 (step S08, No), the preprocessing ends after the logical-to-physical conversion table stored in the controller 6 is recorded in the nonvolatile memory 12 ( step S14).

[1.2.2. Unauthorized access check processing in in-vehicle secure storage system]
FIG. 3 is a flowchart of basic processing including unauthorized access check processing in the in-vehicle secure storage system 2 according to this embodiment. When the basic processing starts (step S20), first, the initialization processing of the storage device 4 is performed (step S22). The non-volatile memory 12 in the storage device 4 logically has one or more areas (logical areas), so the initialization process is set so that appropriate control is performed for each area.

In the basic processing including the unauthorized access check processing, it is determined whether or not the basic processing has ended (step S24). (step S26) is repeatedly confirmed. This step S<b>26 is performed by the controller 6 of the storage device 4 confirming whether or not an instruction for accessing the nonvolatile memory 12 has come from the vehicle-mounted ECU 20 .

If there is access from the in-vehicle ECU 20 to the storage device 4 in the basic processing (step S26, Yes), the controller 6 of the storage device 4 performs unauthorized access check by analysis (step S28). If it is determined in the basic processing that there is no unauthorized access (step S30, No), the occurrence of the next access is further awaited. When it is determined that there is unauthorized access in the basic processing (step S30, Yes), the controller 6 of the storage device 4 and the in-vehicle ECU 20 perform processing according to the unauthorized access (step S32). Here, the details of "unauthorized access check" (step S28) and "processing in response to unauthorized access" (step S32) will be described later with reference to FIG.

If the basic processing has ended (step S24, Yes), the entire processing ends (S34).

[1.2.3. Defect check processing in in-vehicle secure storage system]
FIG. 4 is a flowchart of defect check processing in the in-vehicle secure storage system 2 according to this embodiment. The in-vehicle secure storage system 2 executes unauthorized access check processing shown in FIG. 3 during basic processing. In addition, the in-vehicle secure storage system 2 is triggered by an interrupt by a timer or access from the in-vehicle ECU 20, which is a host, and starts execution of the trouble check process shown in FIG. 4 (step S40).

The controller 6 of the storage device 4 first acquires the number Num=X of logical areas on the nonvolatile memory 12 (step S42). If there is no logical area (that is, it is zero) (step S44, No), the defect check process ends (step S60). 6 increments the area counter C (step S46). The case where there is no logic area includes the case where the nonvolatile memory 12 blocks the access of the controller 6 . If the area counter C does not exceed Num (the number of logical areas) (step S48, No), the controller 6 of the storage device 4 checks whether there is any defect (that is, abnormality) in the Cth logical area. (ie, confirm) (step S50).

If it is determined that there is no problem in the problem check process (step S52, No), the increment process of the area counter C (step S46) and subsequent steps are repeated. If it is determined that there is a problem in the problem check process (step S52, Yes), a process corresponding to the problem is performed (step S54). The processing according to the malfunction includes recovery, notification, instruction to the driver, and the like.

After step S54, the defect check process may directly end (step S60). Further, after step S54, as indicated by the dotted line and arrow in the flowchart of FIG. 4, the defect check process may return to immediately before the increment process of the area counter C (step S46). In this case, the defect check process repeats the increment process of the area counter C (step S46) and thereafter. Therefore, the process of confirming whether or not there is a defect in all areas (step S50), and when it is determined that there is a defect (step S52, Yes), the process corresponding to the defect (step S54) is performed. become.

When the area counter C exceeds Num (the number of logical areas) (step S48, Yes), the defect check process ends (step S60).

[1.2.4. Types of checks for unauthorized access and defects, and corresponding processing]
Specific types of checks for unauthorized access and defects, and specific operations of processes corresponding to them, of which the flow of processing is shown using FIGS. 3 and 4, will be described using the list of FIG. It should be noted that the types of checks for unauthorized access and defects described below and the operations of the corresponding processes are merely examples, and are not limited to the following.

[1.2.4.0. premise]
Before describing the specific types of checks for unauthorized access and defects, and the specific operations of processing corresponding to them, first, the contents of a table that holds information about the host for each area of the nonvolatile memory 12 in the controller 6 will be described. show.
The controller 6, for each area of the nonvolatile memory 12:
(1) Accessible host (2) Usable operations (write operation, read operation, copy operation, move operation, erase operation) when the host is accessible
(3) Information indicating whether or not another area can be added as a writable area when accessed by access outside the area (5) a table defining information indicating attributes (application IDs) of accessible applications.

[1.2.4.1. Access area violation]
A first type of unauthorized access is "access area violation". An "access area violation" is defined as an access from a host to an area for which access is not permitted. An example of its content is that the region ID or start address in the operation from the host is incorrect. The controller 6 detects whether or not there is an access area violation by comparing the area of the non-volatile memory 12 represented by the area ID of the operation target or the start address with the host that issued the command.
When an access area violation occurs, the controller 6 of the storage device 4 prohibits all access from the corresponding host, including the permitted area. Note that the countermeasures are not limited to those described above. For example, the controller 6 of the storage device 4 may prohibit only access by write operations from the host that has violated the access area.
When an access area violation occurs, the controller 6 of the storage device 4 notifies the host in the form of an operation error.

[1.2.4.2. Access mode violation]
A second type of unauthorized access is "access mode violation." An "access mode violation" is defined as an access that includes an instruction other than an executable operation to a region where executable operations are restricted. An example of the content is that the operation, region ID, or start address, which is a command from the host, is incorrect.
If an access mode violation occurs, the controller 6 of the storage device 4 prohibits the operation. Furthermore, if similar accesses continue, the controller 6 of the storage device 4 temporarily disables access to the area and notifies the host of the content of the access mode violation. Take action by requesting a response. The host requested to take action identifies the application that is making the access based on the contents of the access mode violation, and performs processing such as restricting the operation of the application.
The controller 6 of the storage device 4 notifies the host in the form of an operation error.

[1.2.4.3. Illegal data tampering]
A third type of unauthorized access is "unauthorized data falsification." “Illegal data tampering” is defined as a case where a specific area is illegally tampered with. Here, the data check method is stored in advance in the controller 6 of the storage device 4 . The contents of "unauthorized data falsification" are determined as falsification by a pre-stored data check method.
The controller 6 of the storage device 4 protects the current data on the nonvolatile memory 12, notifies the host of the access, and requests the host to recheck the data.
The controller 6 of the storage device 4 notifies the host in the form of a command error or in the form of an interrupt.

[1.2.4.4. Illegal writing]
A fourth type of unauthorized access is "unauthorized writing". "Illegal writing" is defined as when an illegal writing occurs to a specific area. Here, attributes and contents (address, data type, etc.) of write data to be written are stored in advance in the controller 6 of the storage device 4 for each area of the nonvolatile memory 12 . The content of "illegal write" is that the attribute and content of the write data are not what should have been stored in advance.
When illegal writing occurs, the controller 6 of the storage device 4, as an example of countermeasures, affixes a sign to the written data, sets the area in which the data is written as a read-only area, and later releases it from the host. The countermeasure is to keep the area read-only until an instruction comes. The reason why the code is attached to the written data is, for example, so that the host can easily find the data after the fact.
The controller 6 of the storage device 4 notifies the host of the operation error in the form of a response to the operation or in the form of an interrupt.

[1.2.4.5. Out-of-area write access]
As a fifth type of unauthorized access, there is an “outside write access”. "Outside area write access" is defined as access outside the area set for the specified area ID. As an example of the content, for example, although the addresses of area ID1 are defined as addresses 0 to 2000, a write operation to area ID1 starts from address 2001.
If an out-of-area write access occurs, and if the information indicating whether or not it is possible to add another area as a writable area when accessed by an out-of-area write access, the storage The controller 6 of the device 4 automatically secures a new area within the nonvolatile memory and adds it as a continuous area.
The controller 6 of the storage device 4 notifies the host that the area has been expanded.

[1.2.4.6. continuous access mode violation]
A sixth type of unauthorized access is "consecutive access mode violation". "Consecutive access mode violation" is defined as the case where accesses with access mode violation are performed more than a predetermined number of times. An example of a continuous access mode violation is a case in which it is detected that the process of writing predetermined data to a predetermined read-only address has been performed a predetermined number of times in succession.
When a continuous access mode violation occurs, the controller 6 of the storage device 4 temporarily cancels the read-only mode, enables writing until predetermined data is written to a predetermined address, and reads when predetermined data is written to a predetermined address. Take action to return it to private use. In other words, the controller 6 performs access mode switching using an access mode violation. Whether or not such measures are possible may be determined for each region, or such measures may be possible for all regions.
The controller 6 of the storage device 4 notifies the host whether the countermeasure was successful or unsuccessful by a command response.

[1.2.4.7. Unauthorized access to areas for automated driving]
A seventh type of unauthorized access is "unauthorized access to the area for automatic driving". “Unauthorized access to the autonomous driving area” is defined as the detection of unauthorized access to the autonomous driving area. An example of the content is that the write operation is for the area for automatic driving and is performed from an application other than an application (for example, an automatic driving program update application) for which access is permitted.
If unauthorized access to the area for automatic operation occurs, the controller 6 of the storage device 4 invalidates part or all of the relevant area for automatic operation, or suspends or partially limits the function of automatic operation. I do. Further, the controller 6 of the storage device 4 takes measures such as notifying the host of stopping the automatic operation or restricting some functions. In response to this, the in-vehicle ECU 20 suspends automatic driving or restricts some functions.
The controller 6 of the storage device 4 notifies the host in the form of an interrupt.

[1.2.4.8. fatal failure detection]
A first type of failure (abnormality) detected in step S52 includes "detection of fatal failure". "Fatal failure detection" is the detection of failures in which a fatal error occurs in each area and it is determined that automatic recovery within the storage is not possible.In other words, automatic recovery within the in-vehicle secure storage system is impossible. is defined as the detection of a fault determined to be An example of the content is that recovery was not possible in spite of the fact that recovery was attempted in step S54 of the defect check (see FIG. 4).
When a fatal failure is detected, the controller 6 of the storage device 4 cuts all or part of access from the host to the nonvolatile memory 12 and notifies the host of the occurrence of the fatal failure. . In response to this, the in-vehicle ECU 20 serving as a host uses the external communication function of the external communication module 18 to notify the external service center.
The controller 6 of the storage device 4 notifies the host of the operation error in the form of a response or in the form of an interrupt.

[1.2.4.9. Area abnormality detection]
As the second failure (abnormality) detected in step S52, there is "detection of area abnormality". "Detection of area abnormality" is defined as a case where the controller 6 determines that an area abnormality has occurred due to detection of data destruction, hardware error, or the like. The content of the inspection is defect detection by defect check (see FIG. 4).
When an area abnormality is detected, the controller 6 performs any or all of the following processes as the process of step S54.
[1] The controller 6 of the storage device 4 issues an instruction to switch to the backup area of the corresponding area. This backup area is prepared in advance. The controller 6 of the storage device 4 notifies the in-vehicle ECU 20, which is the host, of the switching.
The controller 6 of the storage device 4 notifies the host in the form of an interrupt or the like that the area switching has been performed.
[2] Also, the controller 6 of the storage device 4 may recover the broken volume. This recovery is performed using a preconfigured RAID. The controller 6 of the storage device 4 notifies the in-vehicle ECU 20, which is the host, of the recovery.
The controller 6 of the storage device 4 notifies the host in the form of an interrupt or the like that recovery has been performed.
[3] In addition, the controller 6 of the storage device 4 automatically distributes and records the data inside the non-volatile memory 12, and then automatically recovers the failed area from other areas. Sometimes. The controller 6 of the storage device 4 notifies the in-vehicle ECU 20, which is the host, that the data has been automatically distributed and recorded, and that the failed area has been automatically recovered from other areas. When data is automatically distributed and recorded inside the nonvolatile memory 12, a secret sharing technique may be used.
The controller 6 of the storage device 4 notifies the host in the form of an interrupt or the like that the distributed recording and recovery of the data have been dealt with.
[4] Furthermore, the controller 6 of the storage device 4 performs recovery by downloading the data in the failed area from the server of the external service center using the external communication function of the external communication module 18. Sometimes. The controller 6 of the storage device 4 notifies the in-vehicle ECU 20, which is the host, of the recovery.
The controller 6 of the storage device 4 notifies the host in the form of an interrupt or the like that recovery has been performed.

[1.2.4.10. Detection of partial catastrophic failure]
A third failure (abnormality) detected in step S52 is "detection of partial fatal failure". "Partial fatal failure detection" is defined as the case where a fatal error occurs in a specific area within "fatal failure detection" and automatic recovery within the storage is not possible. . In other words, the third failure (abnormality), ``detection of a partial fatal failure,'' means that, of the fatal failures, which are the targets of the first failure (abnormality), Detecting faults in specific areas.
The details of detection of a partial fatal failure and the processing of step S54 performed by the controller 6 when a partial fatal failure is detected are one or all of the following.
[1] If a fatal failure occurs in the storage device 4 in an area other than the area used by the in-vehicle navigation system, the controller 6 of the storage device 4 notifies the host that the available functions are functions related to navigation. A certain in-vehicle ECU 20 is notified. In response to this, the in-vehicle ECU 20 serving as a host displays a guide to the nearest repair shop on the monitor 28 to guide the vehicle 1 to the repair shop. Further, the controller 6 of the storage device 4 requests the in-vehicle ECU 20 to notify the external service center using the external communication function of the external communication module 18 .
The controller 6 of the storage device 4 notifies the host in the form of an interrupt.
[2] If a fatal failure occurs in the area used by the in-vehicle navigation system in the storage device 4, the controller 6 of the storage device 4 notifies that the fatal failure has occurred in the area used by the in-vehicle navigation system. , to the in-vehicle ECU 20 serving as a host. In response to this, the in-vehicle ECU 20 serving as a host reads the navigation information to the nearest repair shop from the backup area in the nonvolatile memory 12, displays it on the monitor 28, and automatically guides the vehicle 1 to the repair shop. . Further, the controller 6 of the storage device 4 requests the in-vehicle ECU 20 to notify the external service center using the external communication function of the external communication module 18 .
The controller 6 of the storage device 4 notifies the host in the form of an interrupt.
[3] In the area used by ADAS (Advanced driver-assistance systems) in the storage device 4, if a fatal failure occurs, the controller 6 of the storage device 4 indicates that the ADAS cannot be used. , to the in-vehicle ECU 20 serving as a host. In response to this, the in-vehicle ECU 20, which is the host, uses the image displayed on the monitor 28, the sound output from the speaker 32, or the blinking, color change, or brightness change of the room lamp 26 to indicate that the ADAS cannot be used. , notify the driver. Furthermore, the in-vehicle ECU 20 serving as a host guides the vehicle 1 to the nearest repair shop by automatic operation. Alternatively, the in-vehicle ECU 20 serving as a host displays a guide to the nearest repair shop on the monitor 28 and guides the vehicle 1 to the nearest repair shop by manual operation. Further, the controller 6 of the storage device 4 requests the in-vehicle ECU 20 to notify the external service center using the external communication function of the external communication module 18 .
The controller 6 of the storage device 4 notifies the host in the form of an interrupt.

[1.2.5. Operation of in-vehicle ECU and peripheral devices when in-vehicle ECU receives notification of unauthorized access or malfunction from storage device]
The operations of the in-vehicle ECU 20 and peripheral devices when the in-vehicle ECU 20 receives a notification of unauthorized access or malfunction from the storage device 4 will be described.

[1.2.5.1. Monitor operation]
The operation of monitor 28 will be described. The monitor 28 uses character information/icons or the like according to instructions from the in-vehicle ECU 20 to display cautions or warnings to the driver. The monitor 28 also displays whether or not the driver needs to take urgent action, and advice regarding the driver's operations and actions.

The monitor 28 may switch the color and brightness of the screen according to the content of information to be displayed.

When the in-vehicle system including the storage device 4 requires repair, the monitor 28 may display a screen guiding the user to the nearest repair facility such as a repair shop according to the in-vehicle navigation system. Further, the monitor 28 may display an instruction to call a road service provider, an automobile dealer, or a service center on the screen of the in-vehicle navigation system.

The monitor 28 may receive input from the driver through screen operations. The input by the driver is, for example, the driver's instructions regarding warnings and cautions displayed on the screen. For example, the driver inputs "Immediately go to the repair shop" via the screen of the monitor 28 in response to the warning screen of the occurrence of a failure. Further, for example, the driver inputs "I will go to the repair shop at a later date" via the screen of the monitor 28 in response to the warning screen for failure occurrence.

[1.2.5.2. Operation of speaker and microphone]
Operations of the speaker 32 and the microphone 30 will be described. The speaker 32 notifies the driver of the information displayed on the monitor 28 by speaking. The speaker 32 preferably notifies the driver of the information in a specified language. Further, speaker 32 is preferably configured such that the designated language can be selected from a plurality of languages.

The microphone 30 may be configured to receive input by the driver's voice. The input by the driver's voice here is, for example, the driver's instruction regarding the information notified to the driver by the speaker 32 . For example, in response to the voice information warning of the occurrence of a failure, the driver inputs "immediately go to the repair shop" via the microphone 30 by voice. Further, for example, in response to the voice information warning about the occurrence of a failure, the driver inputs, via the microphone 30, "I will go to the repair shop at a later date" by voice.

[1.2.5.3. Room lamp operation]
The operation of the room lamp 26 will be explained. For the driver who is not good at hearing by hearing, the room lamp 26 notifies caution or warning by blinking, changing color or changing brightness. The room lamp 26 may be configured to change color, blink interval, or brightness depending on the location and content of the obstacle. As a result, the driver can recognize the contents of the unauthorized access and trouble, and use it as a guideline for selecting specific driving operations and actions thereafter.

[1.3. summary]
The in-vehicle secure storage system 2 according to the present embodiment includes a controller 6, a nonvolatile memory 12, a storage device 4 having interfaces (8, 10), and an electronic control unit 20 for electronically controlling the vehicle 1. and an in-vehicle secure storage system 2. After judging that the nonvolatile memory 12 has been illegally accessed or malfunctioned, the controller 6 performs a predetermined process according to the type of the illegal access or malfunction.

With this configuration, the in-vehicle secure storage system 2 can easily and quickly detect unauthorized access to the storage device 4 or malfunction of the storage device 4, and appropriately utilize the detection results.

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, when the controller 6 analyzes the instruction received from the electronic control unit 20 and determines that the instruction to the nonvolatile memory 12 is unauthorized access as a result of the analysis, performs predetermined processing to deal with unauthorized access.

By configuring in this way, the in-vehicle secure storage system 2 can easily and quickly detect unauthorized access to the storage device 4 and appropriately utilize the detection result.

Furthermore, in the in-vehicle secure storage system 2 according to this embodiment, the nonvolatile memory 12 is divided into a plurality of logical areas. The controller 6 confirms whether or not there is a problem in each of the plurality of logical areas by using an interrupt by a timer or communication from the electronic control unit 20 as a trigger, and if it is determined that there is a problem as a result of the confirmation, it responds to the problem. Predetermined processing is performed.

By configuring in this way, the in-vehicle secure storage system 2 can easily and quickly detect a failure of the storage device 4 and appropriately utilize the detection result.

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, the prescribed processing for dealing with unauthorized access and the prescribed processing for dealing with malfunctions are notifications to the electronic control unit.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately utilize detection results of unauthorized access to the storage device 4 or failure of the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, the types of unauthorized access include access area violation, access mode violation, unauthorized data falsification, unauthorized writing, out-of-area write access, continuous access mode violation, and automatic driving. unauthorized access to the user area.

By configuring in this way, the in-vehicle secure storage system 2 can easily and quickly detect unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, unauthorized access is an access area violation, and the prescribed processing for dealing with unauthorized access is to prohibit all accesses from the electronic control unit.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, unauthorized access is an access mode violation, and the prescribed processing for dealing with unauthorized access is to prohibit operations corresponding to the access mode.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, unauthorized access is unauthorized data falsification, and the predetermined processing corresponding to unauthorized access protects the current data on the nonvolatile memory 12, It is to notify the electronic control unit 20 of the access and request the electronic control unit 20 to recheck the data.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, unauthorized access is unauthorized writing, and predetermined processing corresponding to unauthorized access is to add a code to the written data and This means that the area is set as a read-only area, and furthermore, the area is set as read-only until a release command is received from the host later.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, is it possible to add another area as a writable area when an out-of-area write access occurs and is accessed by an out-of-area write access? If information indicating whether or not can be added, the unauthorized access is an outside-area write access, and a predetermined process corresponding to the unauthorized access automatically secures a new area within the nonvolatile memory 12. Adding as a contiguous region.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, unauthorized access is a continuous access mode violation, and the predetermined processing corresponding to the unauthorized access is to cancel the read-only mode once and store a predetermined address at a predetermined address. To enable writing until data is written, and to return to read-only when predetermined data is written to a predetermined address.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, unauthorized access is unauthorized access to the automatic driving area, and the predetermined processing corresponding to the unauthorized access is a part of the relevant automatic driving area or It is to invalidate all, to perform processing to stop or partially limit the function of automatic operation, and to notify the host that automatic operation will be stopped or that some functions will be limited.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of unauthorized access to the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, the type of failure is the detection of a fatal failure that is determined to be a failure that cannot be automatically recovered within the in-vehicle secure storage system, It is either detection of an area abnormality or detection of a failure relating to a specific area relating to a specific function of the non-volatile memory among fatal failures.

By configuring in this way, the in-vehicle secure storage system 2 can easily and quickly detect a failure of the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, the failure is detection of the fatal failure described above, and the predetermined processing corresponding to the failure is to stop all accesses to the nonvolatile memory 12 from the host. Or to cut off part of it.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of the failure of the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, a failure is detection of an area abnormality, and a predetermined process corresponding to the failure is switching to the backup area of the corresponding area.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of the failure of the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to the present embodiment, the failure is detection of a failure in a specific area related to a specific function of the nonvolatile memory among the fatal failures described above. is to request the electronic control unit 20 to notify the external service center by external communication.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use the detection result of the failure of the storage device 4 .

Furthermore, in the vehicle-mounted secure storage system 2 according to this embodiment, the electronic control unit 20 is connected to the monitor 28 . When the electronic control unit 20 receives the notification, it displays a caution or warning on the screen of the monitor 28 .

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use detection results regarding unauthorized access to the storage device 4 or failure of the storage device 4 .

Furthermore, in the vehicle-mounted secure storage system 2 according to this embodiment, the electronic control unit 20 is connected to the speaker 32 and the microphone 30 . When receiving the notification, the electronic control unit 20 causes the speaker 32 to utter information regarding caution or warning, and the microphone 30 accepts voice input.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use detection results regarding unauthorized access to the storage device 4 or failure of the storage device 4 .

Furthermore, in the in-vehicle secure storage system 2 according to this embodiment, the electronic control unit 20 is connected to the room lamp 26 . Upon receiving the notification, the electronic control unit 20 blinks the room lamp 26, changes the color, or changes the brightness.

By configuring in this way, the in-vehicle secure storage system 2 can appropriately use detection results regarding unauthorized access to the storage device 4 or failure of the storage device 4 .

(Other embodiments)
As described above, Embodiment 1 has been described as an example of the technology disclosed in the present application. However, the technology in the present disclosure is not limited to this, and can be applied to embodiments in which modifications, replacements, additions, omissions, etc. are made as appropriate. For example, although nonvolatile memory 12 is divided into a plurality of logical areas in this embodiment, it is not necessary to divide. That is, the nonvolatile memory 12 may have only a single logic area. The connection between the main bus interface 8, the external communication module 18, and/or the main bus interface 22 may be network connection using Ethernet (registered trademark) instead of bus connection using PCIe or the like. Also, in the present embodiment, the controller 6 notifies the host in the form of a response to an operation or an interrupt, but the method of exchanging information between the controller and the host is not limited to this. In other words, instead of the controller 6 notifying the host, the content to be notified is recorded as a log in a predetermined area in the nonvolatile memory 12, and the host reads the predetermined area by itself so that the host can It may be configured to detect unauthorized access, data falsification caused by unauthorized access, and system failure. By configuring in this way, the in-vehicle secure storage system 2 can appropriately utilize detection results regarding unauthorized access to the storage device 4 or failure of the storage device.

Also, the accompanying drawings and detailed description have been provided to explain the embodiments. Therefore, among the components described in the attached drawings and detailed description, there are not only components essential for solving the problem, but also components not essential for solving the problem in order to illustrate the above technology. can also be included. Therefore, it should not be immediately recognized that those non-essential components are essential just because they are described in the attached drawings and detailed description.

In addition, the above-described embodiments are intended to illustrate the technology of the present disclosure, and various modifications, replacements, additions, omissions, etc. can be made within the scope of the claims or equivalents thereof.

INDUSTRIAL APPLICABILITY The present invention can be used in an in-vehicle storage system, particularly an in-vehicle storage system in a vehicle equipped with an automatic driving system.

1... vehicle, 2... in-vehicle secure storage system, 4... storage device, 6... controller, 8... main bus interface, 10... side band interface, 12... non-volatile Memory 14 PCIe bus 16 Side band bus (SD bus) 18 External communication module 20 Electronic control unit 22 Main bus interface 24 Sideband interface 26 Room lamp 28 Monitor 30 Microphone 32 Speaker.

Claims (5)

An in-vehicle secure storage system comprising a storage device having a controller, a non-volatile memory, and an interface, and an electronic control unit for electronically controlling the vehicle,
After judging that the non-volatile memory has been illegally accessed or malfunctioned, the controller performs a predetermined process according to the type of the illegal access or malfunction,
analyzing the instruction received from the electronic control unit, and performing predetermined processing corresponding to the unauthorized access when it is determined that the instruction to the nonvolatile memory is unauthorized access as a result of the analysis;
the unauthorized access is unauthorized data falsification;
The predetermined processing corresponding to the unauthorized access protects the current data on the nonvolatile memory, notifies the electronic control unit of the unauthorized access, and requests the electronic control unit to recheck the data. is to request
In-vehicle secure storage system. A storage device having a controller, a non-volatile memory, and an interface, and an electronic control unit that electronically controls the vehicle
An in-vehicle secure storage system comprising
After judging that the non-volatile memory has been illegally accessed or malfunctioned, the controller performs a predetermined process according to the type of the illegal access or malfunction,
analyzing the instruction received from the electronic control unit, and performing predetermined processing corresponding to the unauthorized access when it is determined that the instruction to the nonvolatile memory is unauthorized access as a result of the analysis;
the unauthorized access is unauthorized writing;
The predetermined processing for dealing with the unauthorized access is to add a sign to the written data, set the area in which the data is written as a read-only area, and read the area until a release command is received from the host later. It means to keep it for exclusive use,
In-vehicle secure storage system. A storage device having a controller, a non-volatile memory, and an interface, and an electronic control unit that electronically controls the vehicle
An in-vehicle secure storage system comprising
After judging that the non-volatile memory has been illegally accessed or malfunctioned, the controller performs a predetermined process according to the type of the illegal access or malfunction,
analyzing the instruction received from the electronic control unit, and performing predetermined processing corresponding to the unauthorized access when it is determined that the instruction to the nonvolatile memory is unauthorized access as a result of the analysis;
If an out-of-area write access occurs, and if information indicating whether or not another area can be added as a writable area when accessed by an out-of-area write access is possible,
the unauthorized access is an out-of-area write access;
The predetermined processing corresponding to the unauthorized access is to automatically secure a new area in the nonvolatile memory and add it as a continuous area.
In-vehicle secure storage system. A storage device having a controller, a non-volatile memory, and an interface, and an electronic control unit that electronically controls the vehicle
An in-vehicle secure storage system comprising
After judging that the non-volatile memory has been illegally accessed or malfunctioned, the controller performs a predetermined process according to the type of the illegal access or malfunction,
analyzing the instruction received from the electronic control unit, and performing predetermined processing corresponding to the unauthorized access when it is determined that the instruction to the nonvolatile memory is unauthorized access as a result of the analysis;
the unauthorized access is a continuous access mode violation;
The predetermined process for dealing with the unauthorized access is to temporarily cancel the read-only mode, enable writing until predetermined data is written to a predetermined address, and return to read-only mode when predetermined data is written to a predetermined address. be,
In-vehicle secure storage system. A storage device having a controller, a non-volatile memory, and an interface, and an electronic control unit that electronically controls the vehicle
An in-vehicle secure storage system comprising
After judging that the non-volatile memory has been illegally accessed or malfunctioned, the controller performs a predetermined process according to the type of the illegal access or malfunction,
The nonvolatile memory is divided into a plurality of logical areas,
The controller is triggered by an interrupt by a timer or by communication from the electronic control unit to check whether or not there is a problem in each of the plurality of logic areas. perform the corresponding predetermined processing;
The failure is a failure related to a specific area related to a specific function of the non-volatile memory, among fatal failures that are judged to be failures that cannot be automatically recovered within the in-vehicle secure storage system. is detection,
The predetermined processing corresponding to the malfunction is to request the electronic control unit to notify an external service center through external communication.
In-vehicle secure storage system.

Images